What is the CVSS score of CVE-2026-60601?

CVE-2026-60601 has a CVSS 3.1 base score of 4.4 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.1%.

PeopleSoft Enterprise FIN CVE-2026-60601

EUVD-2026-46959 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-x83c-g943-qjwx

Authentication Bypass Oracle Peoplesoft Enterprise Fin Common Objects

4.4

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

4.4 MEDIUM

AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N

vuln.today AI

4.4 MEDIUM

Local vector and low-privilege requirement are directly stated in description; high complexity and required user interaction confirmed; integrity-only impact with no confidentiality or availability loss.

3.1 AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N

4.0 AV:L/AC:H/AT:P/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 09:04 vuln.today

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise FIN Common Objects product of Oracle PeopleSoft (component: Security). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where PeopleSoft Enterprise FIN Common Objects executes to compromise PeopleSoft Enterprise FIN Common Objects. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise FIN Common Objects accessible data. CVSS 3.1 Base Score 4.4 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N).

AnalysisAI

Integrity compromise in Oracle PeopleSoft Enterprise FIN Common Objects 9.2 allows a low-privileged local attacker to perform unauthorized creation, deletion, or modification of critical financial data when human interaction from another user is obtained. The vulnerability resides in the Security component and carries a CVSS 3.1 base score of 4.4, reflecting high attack complexity and a local-only attack vector. No public exploit code or active exploitation has been identified at time of analysis, and Oracle has disclosed the issue via its July 2026 Critical Patch Update.

Technical ContextAI

Oracle PeopleSoft Enterprise FIN Common Objects is the shared foundation layer for PeopleSoft Financials modules (Accounts Payable, General Ledger, Asset Management, etc.), version 9.2. The affected component is the Security subsystem within this shared object layer. The vulnerability is tagged 'Authentication Bypass,' suggesting that under specific local conditions a low-privileged user can circumvent security controls that gate write access to critical financial data objects. No CWE classification was provided by Oracle or NVD, which limits root-cause analysis, but the combination of AV:L, PR:L, and I:H is consistent with a local privilege escalation or authorization-bypass pattern where the attacker manipulates security context while relying on a co-located privileged user to trigger a sensitive operation. The scope is unchanged (S:U), confirming impact is contained within the PeopleSoft application boundary.

RemediationAI

Apply Oracle's July 2026 Critical Patch Update, available via the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle does not publicly disclose the exact patched build number in CPU advisories, so confirm the applicable patch ID through Oracle Support (MOS). An exact fixed version was not independently confirmed from the available reference data. As a compensating control pending patch deployment, restrict local logon access to the PeopleSoft application server infrastructure to only service accounts and named administrators - this directly addresses the AV:L requirement and eliminates the attacker's foothold. Additionally, audit PeopleSoft role assignments to enforce least-privilege on the FIN Common Objects Security component, reducing the pool of low-privileged accounts that could be leveraged. Note that restricting logon access may impact legitimate batch processing accounts, so coordinate with application owners before tightening access.